NOTE: Compare the DPC's summaries of the submissions by the complainant against the relevant documents, as arguments are partly missing, not accurately reflected or taken out of context.
4
ISSUE 2 - RELIANCE ON 6(1)(B) AS A LAWFUL BASIS FOR PERSONAL DATA PROCESSING
4.1 As set out above, the Complainant contends that Facebook’s processing of personal data under the Terms of Service must be based entirely on consent as a legal basis under the GDPR. I have already found that this is not the case on the basis that there is no hierarchy of legal bases in the GDPR and there is nothing to support the contention that the agreement in question must, as a matter of law, be based on consent. The Complainant’s argument also rests on the contention that Facebook cannot rely on Article 6(1)(b) GDPR to process personal data in order to perform the Terms of Service. 4.2 In considering this issue, I will first address the relationship between the Terms of Service and the Data Policy. This assessment is necessary as the Complainant argues that she “agreed” to the Data Policy by accepting Facebook’s updated Terms of Service. Facebook has argued that this position is not correct. After coming to a conclusion on this matter, I will then consider the substantive question of whether Facebook is entitled to rely on Article 6(1)(b) GDPR as a lawful basis for the processing of personal data. THE RELATIONSHIP BETWEEN THE TERMS OF SERVICE AND DATA POLICY 4.3 The Complainant alleges that in clicking the “accept” button, she agreed to both the Data Policy and the Terms of Service and that the alleged non-compliance is compounded by the agreement to both documents.38 In examining this aspect of the Complaint, the Investigator was of the view that that the data subject’s formal agreement to the Data Policy was not a component of the data subject’s contract with Facebook. The Investigator also acknowledged in the Final Report that the Complainant seems to have conceded that there is no “consent” and therefore no “agreement” to the Data Policy.39 4.4 In respect of this matter, the Investigator concluded that, as Facebook has stated that the Terms of Service “make up this entire agreement” between Facebook and the Facebook user, there is no explicit indication, in the view of the Investigator, that Facebook intends the separate Data Policy to be part of that agreement. When Facebook sought agreement to the terms under dispute in this Inquiry, it invited users to also accept the updated Terms of Service and also included information on the Data Policy. In the Investigator’s view, this illustrates that the Terms of Service and the Data Policy are entirely separate. Facebook’s position is that the Data Policy is simply a compliance document setting out information required by the GDPR, whereas the contractual document is the Terms of Service.40
38
Complaint, page 3. Final Report, paragraph 145. 40 Facebook Submissions on Preliminary Draft Decision, paragraphs 5.5 - 5.6. 39
